[Barracuda] Email Gateway Attachment_Content Event Detected

alert any $HOME_NET any -> $HOME_NET any (msg:"[Barracuda] Email Gateway Attachment_Content Event Detected"; content:"
| 22
| reason
| 22 3a 22
| Attachment_Content
| 22
| "; nocase; meta_content:!"
| 22
| action
| 22 3a 22
| %sagan%
| 22
| ",blocked,quarantined,deferred; parse_src_ip:1; reference:url,https://campus.barracuda.com/product/emailgatewaydefense/doc/167976683/message-actions; program:barracuda_email; classtype:suspicious-activity; sid:5015520; rev:1;)